def bytes_without_jmp(self): """ Clear all jump instructions. jmp -> nop jxx -> nop call xxx -> push ret_addr """ buf = '' from miasm2.arch.x86.arch import mn_x86 from miasm2.arch.x86.arch import conditional_branch from miasm2.arch.x86.arch import unconditional_branch from miasm2.expression.expression import ExprInt branch_name = conditional_branch + unconditional_branch call_name = ['CALL'] for ins in self.instructions: ins_x86 = mn_x86.dis(ins.bytes, 32) if ins_x86.name in branch_name: buf += '\x90' # NOP elif ins_x86.name in call_name: ret_addr = ExprInt(ins.addr + ins.size, 32) ins_x86.args = [ret_addr] ins_x86.name = 'PUSH' buf += mn_x86.asm(ins_x86)[0] else: buf += ins.bytes return buf
def compute(ir, mode, asm, inputstate={}, debug=False): instr = mn.fromstring(asm, mode) code = mn.asm(instr)[0] instr = mn.dis(code, mode) instr.offset = inputstate.get(EIP, 0) interm = ir() interm.add_instr(instr) return symb_exec(interm, inputstate, debug)
def compute(ir, mode, asm, inputstate={}, debug=False): loc_db = LocationDB() instr = mn.fromstring(asm, loc_db, mode) code = mn.asm(instr)[0] instr = mn.dis(code, mode) instr.offset = inputstate.get(EIP, 0) ir_arch = ir(loc_db) ircfg = ir_arch.new_ircfg() lbl = ir_arch.add_instr_to_ircfg(instr, ircfg) return symb_exec(lbl, ir_arch, ircfg, inputstate, debug)
from miasm2.arch.x86.arch import mn_x86 from miasm2.arch.x86.regs import * l = mn_x86.fromstring('MOV EAX, EBX', 32) print "instruction:", l print "arg:", l.args[0] x = mn_x86.asm(l) print x l.args[0] = EDX y = mn_x86.asm(l) print y print mn_x86.dis(y[0], 32)
# Minimalist Symbol Exec example from miasm2.core.bin_stream import bin_stream_str from miasm2.arch.x86.arch import mn_x86 from miasm2.arch.x86.ira import ir_a_x86_32 from miasm2.arch.x86.regs import all_regs_ids, all_regs_ids_init from miasm2.ir.symbexec import symbexec from miasm2.arch.x86.disasm import dis_x86_32 as dis_engine import miasm2.expression.expression as m2_expr l = mn_x86.fromstring("MOV EAX, EBX", 32) asm = mn_x86.asm(l)[0] bin_stream = bin_stream_str(asm) mdis = dis_engine(bin_stream) disasm = mdis.dis_multibloc(0) ir = ir_a_x86_32(mdis.symbol_pool) for bbl in disasm: ir.add_bloc(bbl) symbols_init = {} for i, r in enumerate(all_regs_ids): symbols_init[r] = all_regs_ids_init[i] symb = symbexec(ir, symbols_init) block = ir.get_bloc(0) cur_addr = symb.emulbloc(block) assert(symb.symbols[m2_expr.ExprId("EAX")] == symbols_init[m2_expr.ExprId("EBX")]) print 'modified registers:' symb.dump_id()